diff --git a/CHANGELOG.md b/CHANGELOG.md
index 574eb9c..db0ae7c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+1.0.3 (unreleased) 
+----
+* commons compress 1.24.0 (used by testcontainers) updated for a CVE.
+* testcontainers 1.19.0
+
 1.0.2
 -----
 * Internally split off from otj-parent to allow compatibility between different otj stacks and not pull as much otj-ness.
diff --git a/pom.xml b/pom.xml
index 52ba8d8..01bfce8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,12 +48,13 @@
     <project.build.targetJdk>11</project.build.targetJdk>
     <maven.compiler.target>${project.build.targetJdk}</maven.compiler.target>
     <project.build.systemJdk>${project.build.targetJdk}</project.build.systemJdk>
-    <dep.testcontainers.version>1.18.3</dep.testcontainers.version>
+    <dep.testcontainers.version>1.19.0</dep.testcontainers.version>
     <dep.postgres-jdbc.version>42.5.1</dep.postgres-jdbc.version>
     <dep.liquibase.version>4.23.1</dep.liquibase.version>
     <dep.slf4j.version>1.7.36</dep.slf4j.version>
     <dep.flyway.version>8.5.13</dep.flyway.version>
     <dep.commons-lang.version>3.12.0</dep.commons-lang.version>
+    <dep.commons-compress.version>1.24.0</dep.commons-compress.version>
     <dep.junit.version>4.13.2</dep.junit.version>
     <dep.junit5.version>5.8.2</dep.junit5.version>
     <basepom.test.timeout>1800</basepom.test.timeout>
@@ -84,6 +85,12 @@
       <artifactId>commons-lang3</artifactId>
       <version>${dep.commons-lang.version}</version>
     </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-compress</artifactId>
+      <version>${dep.commons-compress.version}</version>
+      <scope>runtime</scope>
+    </dependency>
 
     <dependency>
       <groupId>org.flywaydb</groupId>